Vulnerability intelligence

CVE-2026-71479

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quota_math.go and related settlement paths, allowing a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds. This issue is fixed in version 1.0.0-rc.18.

CVSS Score

9.1

Critical

EPSS — Exploit Probability

0.6%

Riskier than 49% of all CVEs · checked 2026-10-01

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Aug 18, 2026 · latest Aug 18, 2026

Coverage timeline

CVE-2026-71479: New API Integer Overflow Exploited in the Wild
securityonline.info · Aug 18, 2026